Problem: [logstash.outputs.elasticsearch] Could not index event to Elasticsearch-wazuh-alerts-3.x-2020.05.30

filebeat adds a [host] object to events, and that object contains the field called [host][name] which contains the name of the host. Some other inputs add a [host] field to events and that field contains the name of a host.

In elasticsearch a field cannot be an object on some documents and a string on others. You have to pick one or the other. If you pick string and try to add a document where [host] is an object then you get the exact error message that you are seeing.

{"type"=>"illegal_argument_exception", "reason"=>"mapper [host] of different type, current_type [keyword], merged_type [ObjectMapper]"}

In the index the field type is "keyword" (i.e. string) but you are trying to insert a document where it would be an object.

You need to decide whether you want to have [host] be an object or a string. If you want it to be an object and your input produces a string (e.g. a syslog input) then

if ! [host][name] { mutate { rename => { "[host]" => "[host][name]" } } }

may be a solution. If you want it to be a string and your input produces an object (e.g. a beats input) then

mutate { replace => { "[host]" => "[host][name]" } }

might be a solution. Note that is replace, not rename, so the meaning of the order of arguments is reversed.

If your input produces an object and you want it to be an object then just rolling over to a new index might be a solution.